PT-2026-62043 · Egor · Data::Sortedset::Shared
CVE-2026-59140
·
Published
2026-07-21
·
Updated
2026-07-21
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.
The attach-time validator ss validate header bounds only the root index against the node pool (node capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node capacity. A full structural check (ss validate tree) exists but runs only via an explicit validate method, not on attach.
A local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process.
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Data::Sortedset::Shared